18.3 Privacy, Fraud, and Consumer Protection
Key Takeaways
- GLBA/NAIC privacy rules require a privacy notice (initial and annual) plus an opt-out notice before sharing NPI with nonaffiliated third parties; affiliate and policy-servicing sharing is generally exempt from opt-out.
- FCRA requires disclosure of consumer reports and an adverse-action notice (naming the reporting agency) whenever a report contributes to a declination, higher rate, or nonrenewal.
- 18 U.S.C. 1033/1034 bars anyone convicted of a felony of dishonesty/breach of trust from insurance work without a written 1033 waiver from the commissioner (up to 10 years' imprisonment).
- Replacement regulation, fraud-warning statements, and free-look rights are core consumer protections that also curb twisting and churning.
- Rate-filing systems range from prior approval (most regulatory control) to open competition (least).
Privacy: Gramm-Leach-Bliley and the NAIC model
The federal Gramm-Leach-Bliley Act (GLBA) and the NAIC Privacy of Consumer Financial and Health Information model regulation govern how insurers and producers handle nonpublic personal information (NPI). The framework distinguishes two notices:
- Privacy notice — describes the company's information-sharing practices; given at the time of the relationship and annually thereafter (with limited exceptions).
- Opt-out notice — must be given before sharing NPI with nonaffiliated third parties, with a reasonable opportunity (commonly 30 days) to opt out.
Trap: Consumers can opt out of sharing with nonaffiliated parties, but generally cannot opt out of sharing with affiliates or sharing necessary to service the policy (e.g., reinsurers, claim adjusters).
Nonpublic personal information includes financial data (account numbers, payment history) and, under the health-information sections, medical data — which receives stricter authorization requirements. A producer who casually emails a client's claim file, Social Security number, or health details to an outside vendor without the proper notice and safeguards risks both a privacy violation and an E&O exposure if the data is misused.
FCRA and adverse-action notices
The Fair Credit Reporting Act (FCRA) governs use of consumer reports and investigative consumer reports (which involve interviews about character and reputation). Key duties:
- Disclose that a report may be obtained.
- If an adverse action (declination, higher rate, nonrenewal) is based in whole or part on a report, give an adverse-action notice naming the consumer-reporting agency and the consumer's right to a free copy and to dispute.
- For investigative reports, give written notice within 3 days of the request.
Trap: The reporting agency is not liable for the insurer's decision — the insurer must issue the adverse-action notice and cannot simply blame the bureau. Many states also restrict the use of credit-based insurance scores: an insurer generally cannot deny, cancel, or nonrenew solely because of credit, and cannot use credit information that is the result of a disputed or extraordinary life event. The consumer always retains the right to a free copy of the report and to dispute inaccurate entries with the agency.
An insurer wants to share a customer's nonpublic personal financial information with an unaffiliated marketing firm. Under GLBA/NAIC privacy rules, the insurer must:
Insurance fraud and the federal fraud statutes
Insurance fraud is a knowing misrepresentation made to obtain a benefit or payment to which one is not entitled — committed by applicants, insureds, claimants, providers, or producers. It is policed at the state level by fraud bureaus and at the federal level by the Fraud and False Statements provisions (18 U.S.C. 1033/1034).
18 U.S.C. 1033/1034 (Violent Crime Control Act): It is a federal crime for any person convicted of a felony involving dishonesty or breach of trust to engage in the business of insurance without written consent (a 1033 waiver) from the state insurance commissioner. Penalties include fines and up to 10 years imprisonment. This is commonly tested — a prior fraud/embezzlement felony bars insurance work absent a waiver.
Fraud also drives premium costs for honest insureds: padded claims, staged accidents, arson-for-profit, and inflated repair invoices are all forms of claimant or provider fraud. Soft fraud (exaggerating an otherwise legitimate claim) and hard fraud (fabricating a loss entirely) are both prosecutable. Producers commit fraud through fictitious applicants, premium theft, or fake policies, which is why most states impose mandatory reporting duties on suspected fraud to the state fraud bureau.
Consumer protection: fraud-warning, replacement, and rate regulation
| Protection | What it requires |
|---|---|
| Fraud warning statement | Many states require a printed warning on applications/claim forms that fraud is a crime |
| Replacement regulation | Disclosure and comparison forms when replacing existing coverage (curbs twisting/churning) |
| Free-look / cancellation rights | A window to review and return certain policies for a full refund |
| Rate regulation | Rates must not be excessive, inadequate, or unfairly discriminatory |
Rate-filing systems trap: Prior approval — file and wait for department approval before use. File-and-use — file, then use after a waiting period or immediately. Use-and-file — use rates, then file shortly after. Open competition (no file) — market sets rates with minimal filing. Know which system gives the regulator the most control (prior approval) versus the least (open competition).
Remember the three statutory rate standards together: rates may not be excessive (too high for the risk, often where competition is weak), inadequate (too low to remain solvent or designed to drive out competitors), or unfairly discriminatory (different rates for the same class and hazard). A rate can be perfectly adequate yet still illegal if it is unfairly discriminatory, so the three tests are independent — an exam item may pass one and fail another.
A person was convicted of felony embezzlement and now wants to work as a P&C producer. Under federal law (18 U.S.C. 1033/1034), this person may engage in the business of insurance only if they:
GLBA Opt-Out, FCRA Notices, and the Fraud Bar
Under Gramm-Leach-Bliley, insurers must give an initial and annual privacy notice and an opt-out before sharing nonpublic personal financial information with nonaffiliated third parties (with exceptions for servicing and law).
The Fair Credit Reporting Act requires an adverse-action notice when a consumer report (including an insurance score) causes a denial, higher rate, or nonrenewal, telling the consumer the agency used and their right to a free report. The federal Violent Crime Control Act (1033/1034) bars anyone convicted of a felony involving dishonesty or breach of trust from working in insurance without written consent of the regulator — a heavily tested compliance rule.